From: Paul Moore <pmoore@redhat.com>
To: Casey Schaufler <casey@schaufler-ca.com>
Cc: Steve Grubb <sgrubb@redhat.com>, Richard Guy Briggs <rgb@redhat.com>,
        linux-audit@redhat.com, linux-kernel@vger.kernel.org
Subject: Re: [PATCH V4 (was V6)] audit: use macros for unset inode and device values
Date: Fri, 07 Aug 2015 10:22:18 -0400
Message-ID: <5436127.FQ1IkbQgGc@sifl>
Organization: Red Hat
User-Agent: KMail/4.14.10 (Linux/4.1.2-gentoo; KDE/4.14.10; x86_64; ; )
In-Reply-To: <55C3D24D.7040602@schaufler-ca.com>
References: <cover.1438446565.git.rgb@redhat.com> <32702596.GifTzGnU6n@x2> <55C3D24D.7040602@schaufler-ca.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 7Bit
Content-Type: text/plain; charset="us-ascii"
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1146
Lines: 23

On Thursday, August 06, 2015 02:31:57 PM Casey Schaufler wrote:
> I remember the Orange Book days when we were *required* to audit by
> dev/inode because it was the only true way to identify the object. Yes,
> it's analogous to auditing the pid, but we had to audit by that, too. The
> dev/indode and pid are the "true" names. Anything else is a hint at what
> you're looking at. I can easily imaging someone who really cares about the
> audit data supplying the dev/inode and pid.

Just to add a bit of clarity, my original question was if there was any value 
in exposing the unset/invalid device and inode values, e.g. -1.  While I agree 
that there is value in auditing by dev/inode, I can't think of a reasonable 
situation where the user would need to pass an unset/invalid device and/or 
inode value into the kernel as part of an audit configuration command.

-- 
paul moore
security @ redhat

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/